{"data":{"id":"1f5b1182-320e-43fa-abaf-85092bbcbd13","title":"CVE-2023-38896: An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the…","summary":"CVE-2023-38896 affects langchain v.0.0.194 and before. A remote attacker can execute arbitrary code through the from_math_prompt and from_colored_object_prompt functions. NIST has not yet provided an NVD assessment, and the NVD entry was published 08/15/2023.","solution":"The source references a patch in pull request https://github.com/hwchase17/langchain/pull/6003, but it does not state a fixed version or configuration change.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-38896","publishedAt":"2023-08-15T21:15:12.027Z","cveId":"CVE-2023-38896","cweIds":["CWE-74"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain@< 0.0.236 (fixed: 0.0.236)"],"affectedPackageNames":["langchain"],"affectedPackageRefs":["pypi:langchain"],"affectedVendors":[],"affectedVendorsRaw":["LangChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01838,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-92j5-3459-qgp4"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:50.418Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-07-19T14:52:31.084Z","daysToFix":-27,"fixCheckedAt":"2026-10-29T21:46:51.153Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain","fixedVersion":"0.0.236","matchedVersion":"0.0.236","fixReleasedAt":"2023-07-19T14:52:31.084Z","daysToFix":-27,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:51.002Z"}]}}